FIG. 1 is a simplified block diagram of a conventional or prior-art computer system 10. In FIG. 1, computer system 10 includes a central processing unit (CPU) 12. CPU 12 is connected to a data entry device 14, which may include a keyboard, mouse or the like. A monitor 16 displays the result of processing, as known in the art. Central Processing Unit 12 is also coupled to a random-access or temporary storage memory (RAM) 18 and to a “permanent” or data storage device 20, which may be flash memory or a hard drive. One or more ancillary information transfer devices, such as a floppy drive or compact disk (CD) drive may be provided. Such ancillary transfer devices are illustrated together as a block 22. The computer 10 of FIG. 1 may also be connected to a communication network, as by means of a modem 24. The ROM 20 of FIG. 1 will ordinarily be loaded with various types of software, including “disk operating” system(s) and user applications, as well as various utilities. A representative software application or binary executable which may be found in ROM 20 is illustrated as a block 40. Software 40 typically includes many “lines” of software instructions or code, illustrated together as 42.
Computer software distributed as binary code to be executed, as in the Microsoft Windows operating system (OS), is inherently vulnerable to reverse engineering. Software engineers have available a variety of tools, such as hex editors, decompilers, disassemblers, debuggers, memory dumpers, and the like, which can aid in the reverse engineering process. Such tools can aid in uncovering and discovering the core functionality of a software system. Reverse engineering when used for compromising intellectual property can be harmful to the owner of the intellectual property, as by reducing or eliminating a competitive advantage.
Protection of software means preventing unauthorized access or copying of portions or all of the software to be protected, and protection against unauthorized modification of code and or data. The technology of software protection may be viewed as being software-based or hardware-based. Software-based software protection schemes involve the alteration or modification of the software in its static state (that is, as manifested on a hard drive or other read-only memory (ROM) medium, such as 20 of FIG. 1. Such alteration may include encryption or compression, and it may also involve addition of anti-tampering code. The result of applying software protection to a static computer program is an altered computer program which is scrambled or otherwise modified in its static state, but which is still capable of running normally if appropriately handled. When any computer program is executed, it is loaded from ROM into random-access memory (RAM), such as RAM 18 of FIG. 1. Thus, when a software-protected program is executed, it may be (a) decrypted andor decompressed, and is then loaded into RAM memory. Once decrypted or decompressed, the program may be (b) checked for the presence of any changes attributable to reverse engineering, (c) changed in RAM memory to complicate analysis of the content, andor (d) checked to determine if monitoring by a debugger is occurring. A disadvantage of software protection of code to be protected is that the code continues to exist within the program in ROM even after the protection is applied, and a software engineer will often know where to look for it. Another disadvantage of software protection is that the original, unaltered program exists in RAM memory space as it executes, and a software engineer knows where to look for it, and may access the original program.
Computers that are used for the processing of sensitive information may have their access restricted by the used of locked rooms, and/or by the use of removable hard drives which are kept in a safe during those times when not in use. The computer protected in this way cannot, or course, be connected to any network, unless the entire network is also within the locked space. This approach uses physical exclusion to protect the data or binary executable.
Another approach to software protection is the hardware method. This method makes use of “external” hardware in addition to the computer and its normal peripherals. The external hardware stores code, data, or encryption/decryption keys, and may even perform some processing. The software to be run communicates explicitly with the external hardware to query for the code, data, or encryption/decryption key, and may also send data to the external hardware for processing. One example of such protection is described in U.S. Pat. No. 5,841,868, issued Nov. 24, 1998 in the name of Helbig, Sr. Another example is application WO02052386 in the name of Gordon Edward LaRose, and entitled Method and System for Software Integrity Using Secure Hardware Assist, published 2002-07-4 by European Patent Office. Such techniques can be effective, but the protection is limited to those computers to which the external hardware is attached. A software engineer will know how to attack the software and hardware in those cases in which there is explicit communication among the elements. The code or data to be protected may eventually find its way to the RAM memory space of the computer, where it will be essentially unprotected.
Improved or alternative methods are desired for the protection of sensitive data or computer code.